Align /token responses with RFC 6749 cache and Basic encoding

[Mehrn0ush]

Summary

• Add Pragma: no-cache on successful token responses alongside existing Cache-Control: no-store, per RFC 6749 section 5.1
• Document in the basicAuth scheme that API key identifier and secret are each application/x-www-form-urlencoded encoded before userid:password and Base64, per RFC 6749 section 2.3.1
• Align the token success example in auth/readme.md with the same Pragma header

Closes #271

Context

RFC 6749 section 5.1 requires both Cache-Control: no-store and Pragma: no-cache on responses that include tokens. OpenAPI previously only declared Cache-Control.

RFC 6749 section 2.3.1 requires form-encoding each credential before building the Basic header. That step matters for secrets containing :, @, or other reserved characters. auth/readme.md already described it; the OpenAPI basicAuth description did not.

[oej]

@taleodor what do you think?

[taleodor]

I think we shouldn't merge this. Pragma is deprecated in RFC 9111 and dropped in OAuth 2.1. I don't think we should mandate a legacy header.

[taleodor]

Alternatively, maybe remove Pragma completely from PR and just keep encoding part?

[Mehrn0ush]

Good catch — agreed. RFC 6749 includes Pragma: no-cache for HTTP/1.0 compatibility, but RFC 9111 deprecates it and OAuth 2.1 dropped it in favor of Cache-Control: no-store alone. I’ll remove the Pragma requirement from this PR and keep the Basic credential encoding clarification.

[Mehrn0ush]

Thanks @taleodor — that makes sense. I’ve removed the Pragma requirement from this PR and kept the Basic form-urlencoded encoding clarification.

[oej]

Are we ready to merge @taleodor ?